How a review works

The same ten steps every time, so you know what happens next and what’s asked of your team.

Before we start

A 30-minute call

We talk through what’s prompting the review and check it’s a good fit.
Proposal and engagement letter

Within three working days: scope, fixed price, liability terms and confidentiality. Half the fee is invoiced when you sign.
Written access authorisation

You confirm in writing which read-only roles I’ll use and for which dates. Nothing is accessed without it.

Discovery workshop

Two to three hours, remote, with your IT lead and someone who can make decisions.
Evidence collection

Your team runs a short list of exports: Secure Score, Conditional Access, admin roles, and Defender and Intune settings. Time-boxed read-only access covers the rest.
Analysis against public baselines

Your settings are checked against the CIS Microsoft 365 benchmark, Microsoft Secure Score, NCSC guidance and Cyber Essentials requirements.
The report

An executive summary, a risk register and a 90-day roadmap, written in plain English.

Readout

A 60–90 minute session to walk through the findings and agree priorities, booked two weeks ahead. The final invoice follows.
Access removed

Access is revoked once the readout is done, and I confirm it in writing.
Follow-up at 30 days

A check on roadmap progress and a chance to raise anything new.

A security review should not create new risk. These rules apply to every engagement.

Your data lives only in a dedicated, encrypted business tenant, separate from any other work.

I never ask for or store your credentials. Access uses named, read-only roles that you grant and that expire.

Working data is deleted within 90 days of delivery. Only the final report and contract records are kept.

You own the report. I keep my methods and templates, which are built only from public frameworks.

Thirty minutes, no charge, and you’ll know whether a review makes sense.